Set PAM Password Hashing Algorithm - password-auth
Forces PAM (pam_unix.so) to hash user passwords with a strong algorithm, yescrypt or sha512, instead of a weak legacy scheme.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Stored passwords are only as safe as the hashing algorithm protecting them. Weak schemes (DES, MD5) are fast to brute-force and trivially cracked from a leaked /etc/shadow, putting every account at risk. Modern algorithms, yescrypt (default on Debian/Ubuntu) and sha512, are slow and salted, drastically raising the cost of offline cracking. Configuring pam_unix.so to use them ensures any password set or changed is stored with strong protection.
What Pavois checks
Pavois greps the active PAM stack under /etc/pam.d/ for a pam_unix.so line carrying sha512 or yescrypt. PAM is the component that actually computes the hash at password-set time, so verifying its configuration captures the policy that will be enforced, more reliable than guessing from already-stored hashes, which only reflect past changes.
describe command('grep -qrE \'pam_unix.so.*(sha512|yescrypt)\' /etc/pam.d/ 2>/dev/null && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -rE 'pam_unix.so.*(sha512|yescrypt)' /etc/pam.d/. The expected output is at least one matching password line (e.g. password ... pam_unix.so ... yescrypt). You can also check the hash of a real account with getent shadow root, a $y$ prefix is yescrypt, $6$ is sha512.
Inspect & investigate
Password changes are recorded via journalctl and /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL). passwd and PAM emit entries there on each password update; the resulting hash format is visible in /etc/shadow.
Remediation
No automated harden plan is defined, so this must be applied manually: ensure the password line for pam_unix.so in /etc/pam.d/common-password (Debian/Ubuntu) or the password-auth/system-auth files (RHEL) includes yescrypt or sha512, and on RHEL set the system-wide default with authselect or /etc/login.defs (ENCRYPT_METHOD SHA512/YESCRYPT).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | # Ensure pam_unix uses a strong hash. Preferred: set in /etc/login.defs: ENCRYPT_METHOD YESCRYPT # (pavois's logindefs-encrypt_method does this). If the benchmark requires the option on the PAM # line, add 'yescrypt' to the pam_unix.so line in /etc/pam.d/common-password (via pam-auth-update). |
|---|---|
| reason | changing the pam_unix hashing option edits the PAM stack, apply via pam-auth-update / review |
| resource | manual |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Changing the hashing algorithm does not rehash existing passwords, they keep their old format until each user next changes their password, so plan a password-rotation if migrating away from a weak scheme. The change itself is safe for active sessions. Avoid removing the password line entirely or mistyping the PAM stack, as a broken pam.d file can lock out logins; test in a console session before closing your only access.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R68 | direct | 2.0 | high |
| CIS | 5.3.3.4.3, 8.3.2 | direct | per OS, see the benchmark table | high |
| NIST | 3.13.11, CM-6(a), IA-5(1)(c), IA-5(c) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 8.3.2 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.